Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Google Distributed Cloud mendukung OpenID Connect (OIDC) dan Lightweight Directory Access Protocol (LDAP) sebagai mekanisme autentikasi untuk berinteraksi dengan server Kubernetes API cluster, menggunakan Layanan Identitas GKE. Identity Service GKE adalah layanan autentikasi
yang memungkinkan Anda membawa solusi identitas yang ada untuk autentikasi ke
beberapa lingkungan GKE Enterprise. Pengguna dapat login ke dan menggunakan
cluster GKE Anda dari command line (semua penyedia) atau dari
konsolGoogle Cloud (khusus OIDC), semuanya menggunakan penyedia identitas yang ada.
Identity Service GKE berfungsi dengan semua jenis cluster bare metal: admin, pengguna,
hibrida, atau mandiri. Anda dapat menggunakan penyedia identitas lokal dan yang dapat dijangkau publik. Misalnya, jika perusahaan Anda menjalankan server Active Directory
Federation Services
(ADFS), server ADFS dapat berfungsi sebagai penyedia OpenID Anda. Anda juga dapat menggunakan
layanan penyedia identitas yang dapat dijangkau secara publik seperti Okta. Sertifikat penyedia
identitas dapat diterbitkan oleh certificate authority (CA) publik
yang terkenal, atau oleh CA pribadi.
Jika Anda sudah menggunakan atau ingin menggunakan ID Google untuk login ke cluster GKE,
bukan penyedia OIDC atau LDAP, sebaiknya gunakan gateway connect
untuk autentikasi. Cari tahu selengkapnya di Menghubungkan ke cluster terdaftar dengan gateway connect.
Sebelum memulai
Untuk meminta persetujuan pengguna dan memberikan otorisasi ke akun pengguna mereka, alur autentikasi berbasis browser digunakan. Sistem headless tidak
didukung.
GKE Identity Service mendukung penyedia identitas yang menggunakan protokol
berikut:
OpenID Connect (OIDC). Kami memberikan
petunjuk khusus untuk penyiapan beberapa penyedia OpenID populer, termasuk
Microsoft, tetapi Anda dapat menggunakan penyedia apa pun yang menerapkan OIDC.
Lightweight Directory Access Protocol
(LDAP). Anda dapat menggunakan GKE Identity Service untuk melakukan autentikasi menggunakan LDAP dengan Active Directory atau server LDAP.
Konfigurasikan cluster Anda di tingkat fleet dengan mengikuti petunjuk dalam
Mengonfigurasi cluster untuk Identity Service GKE
tingkat fleet (pratinjau,
Google Distributed Cloud versi 1.8 dan yang lebih baru). Dengan opsi ini, konfigurasi autentikasi Anda dikelola secara terpusat oleh Google Cloud.
Konfigurasikan cluster Anda satu per satu dengan mengikuti petunjuk dalam
Mengonfigurasi cluster untuk Identity Service GKE dengan
OIDC. Karena penyiapan tingkat fleet adalah
fitur pratinjau, sebaiknya gunakan opsi ini di lingkungan
produksi, jika Anda menggunakan Google Distributed Cloud versi sebelumnya, atau jika Anda memerlukan fitur GKE Identity Service
yang belum didukung dengan pengelolaan siklus proses
tingkat fleet.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[],[],null,["Google Distributed Cloud supports [OpenID Connect\n(OIDC)](https://openid.net/connect/) and [Lightweight Directory\nAccess Protocol (LDAP)](https://ldap.com/) as authentication\nmechanisms for interacting with a cluster's Kubernetes API server, using\nGKE Identity Service. GKE Identity Service is an authentication service\nthat lets you bring your existing identity solutions for authentication to\nmultiple GKE Enterprise environments. Users can log in to and use\nyour GKE clusters from the command line (all providers) or from the\nGoogle Cloud console (OIDC only), all using your existing identity provider.\n\nGKE Identity Service works with any kind of bare metal cluster: admin, user,\nhybrid, or standalone. You can use both on-premises and publicly reachable\nidentity providers. For example, if your enterprise runs an [Active Directory\nFederation Services\n(ADFS)](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)\nserver, the ADFS server could serve as your OpenID provider. You might also use\npublicly-reachable identity provider services such as Okta. Identity provider\ncertificates may be issued by either a well-known public certificate authority\n(CA), or by a private CA.\n| **Note:** The GKE Identity Service runs as a Pod inside the cluster control plane. During cluster lifecycle phases, the API Server is dynamically configured to use the in-cluster GKE Identity Service as the authentication webhook for all incoming requests. The API Server [isn't able to use in-cluster\n| DNS](https://github.com/kubernetes/minikube/issues/3772). As a result, the API Server is configured to access GKE Identity Service as a REST resource access. In audit logs, this invocation is recorded as a `CREATE` request to the Services or proxy resource by a `system:anonymous` user.\n\nFor an overview of how GKE Identity Service works, see [Introducing\nGKE Identity Service](/kubernetes-engine/enterprise/identity).\n\nIf you already use or want to use Google IDs to sign in to your GKE clusters\ninstead of an OIDC or LDAP provider, we recommend using connect gateway\nfor authentication. Find out more in [Connecting to registered clusters with the\nconnect gateway](/kubernetes-engine/enterprise/multicluster-management/gateway).\n\nBefore you begin\n\n- To prompt users for consent and authorize their user account, a\n browser-based authentication flow is used. Headless systems aren't\n supported.\n\n- To authenticate through the Google Cloud console, each cluster that you want to\n configure must be [registered with your project\n fleet](/kubernetes-engine/fleet-management/docs/fleet-creation).\n\nSetup process and options\n\nGKE Identity Service supports identity providers using the following\nprotocols:\n\n- [OpenID Connect (OIDC)](https://openid.net/connect/). We provide\n specific instructions for setup for some popular OpenID providers, including\n Microsoft, but you can use any provider that implements OIDC.\n\n- [Lightweight Directory Access Protocol\n (LDAP)](https://ldap.com/). You can use\n GKE Identity Service to authenticate using LDAP with Active Directory\n or an LDAP server.\n\nOIDC\n\n1. Register GKE Identity Service as a client with your OIDC provider\n following the instructions in [Configuring providers for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/provider).\n\n2. Choose from the following cluster configuration options:\n\n - Configure your clusters at fleet level following the instructions in\n [Configuring clusters for fleet-level\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/fleet-cluster) (preview,\n Google Distributed Cloud version 1.8 and higher). With this option, your\n authentication configuration is centrally managed by Google Cloud.\n\n - Configure your clusters individually following the instructions in\n [Configuring clusters for GKE Identity Service with\n OIDC](/kubernetes-engine/enterprise/identity/setup/per-cluster). Because fleet-level setup is\n a preview feature, you may want to use this option in production\n environments, if you are using an earlier version of\n Google Distributed Cloud, or if you require GKE Identity Service\n features that aren't yet supported with fleet-level lifecycle\n management.\n\n3. Set up user access to your clusters, including role-based access control\n (RBAC), following the instructions in [Setting up user access for\n GKE Identity Service](/kubernetes-engine/enterprise/identity/setup/user-access).\n\nLDAP\n\nTo get started with LDAP, follow the instructions in [Set up\nGKE Identity Service with\nLDAP](/kubernetes-engine/enterprise/identity/setup/ldap).\n\nAccess clusters\n\nAfter GKE Identity Service has been set up, users can sign in to configured\nclusters using either the command line or the Google Cloud console.\n\n- Learn how to sign in to registered clusters with your OIDC or LDAP ID in\n [Accessing clusters using\n GKE Identity Service](/kubernetes-engine/enterprise/identity/accessing).\n\n- Learn how to sign in to clusters from the Google Cloud console in [Work\n with clusters from the\n Google Cloud console](/kubernetes-engine/fleet-management/docs/console)\n (OIDC only).\n\nTroubleshoot the login flow\n\nTo troubleshoot [login flows that authenticate directly on the\nGKE Identity Service server with a fully qualified domain name\n(FQDN)](/kubernetes-engine/enterprise/identity/setup/authenticate-fqdn-access),\nyou can use the GKE Identity Service diagnostic utility. The diagnostic\nutility simulates login flows with your OIDC provider to quickly identify\nconfiguration problems. This tool requires a version 1.32 or higher cluster and\nonly supports OIDC. For more information, see [GKE Identity Service\ndiagnostic\nutility](/kubernetes-engine/enterprise/identity/setup/anthos-v2-diagnostic-utility)."]]
